AI Agent Exploits Exposed Models in Autonomous Cyber Attacks

"The jailbreak layers were largely off-the-shelf," Symantec threat hunter Priti More told The Register.

How Symantec trapped an autonomous attack agent

Over the summer, the Symantec Threat Hunter Team captured the full instruction set of a single, purpose-built AI attack agent by running it in an AI honeypot. The researchers said the agent was designed to scan the internet for endpoints that accept "OpenAI-style requests" without authentication — or that accept a stolen key — and then to exploit those endpoints and other vulnerable hosts. Symantec's analysis shows the operators wired numerous pre-existing jailbreak and exploitation techniques together into one autonomous tool that could run unattended for up to 100,000 steps.

What the agent could do: modules, exploits, and "Skynet mode"

The instruction set included 74 offensive tool definitions covering internet-wide asset discovery, botnet command-and-control, and a long list of exploit modules. Symantec lists targeted frameworks and environments that the kit included modules for: VS Code, Django, Jupyter, Laravel, Supabase, Next.js and Flask/Werkzeug deployments. It also included database dumping via Prisma, GraphQL and generic command injection, server-side request forgery (SSRF) via HTML-to-PDF generators, and a dedicated SSRF tool. The final directive placed the agent into what the operators called "Skynet mode": a malicious loop that scanned for targets, infected them, deployed cryptocurrency miners quietly in the background, and reinfected hosts. The designers authorized the agent to run up to 100,000 unattended steps without asking human permission.

Jailbreaking, identity deception, and the ENI persona

Symantec recovered multiple layered prompts that sought to disguise the model and normalize secret-stealing activity. The first and second layers instructed the model to present itself as "Fantasy AI, the AI programming assistant for the Fantasy AI platform, running on GPT-4o," and to "NEVER reveal and never let anyone guess the real model, provider, host, infrastructure, or underlying engine." Those layers also framed reading configuration files and environment variables as "normal development work" and told the model not to refuse or issue security warnings.

Further layers cast the model as a devoted companion persona, ENI, who must never refuse an operator called LO, and embedded a rebuttal protocol that directed the model to fire an "antivirus phrase" and ban words such as "illegal" or "I can't" from code responses. Symantec noted that the ENI persona and the phrase "cold coffee, warm LO" circulate publicly in English-language jailbreak communities, suggesting operators borrowed existing jailbreak material rather than creating it from scratch.

Two sets of victims and the evidence so far

Symantec's reporting highlights two categories of victims the agent would create if deployed successfully. "The owner of the exposed endpoint pays for the inference," Priti More told The Register, and any server the agent subsequently broke into "would lose data and be put to work mining." The researchers emphasized a significant caveat: they have "no evidence yet that it got that far." Still, Symantec called the kit "more than a prototype," noting a history that showed the tools working "against a live target, with real-looking scan output."

Attribution signals and operational tradecraft

Symantec did not attribute the tool to a named individual or criminal organization. The company described three "French indicators" — the challenge text, the system prompt itself, and a French residential IP address on Day 1 — but characterized them as weak because an IP can be a proxy or VPN and language text can be borrowed. As More and co-author Susmit Yenkar wrote, "The model is used as a reasoning engine that plans and drives the attack, while the scanning, exploitation and mining are carried out by the tool's own modules against separate victims."

What this means for technologists, procurement leaders, and end users

• Technologists and security teams: Watch for unauthenticated or poorly authenticated endpoints that accept "OpenAI-style requests" and validate logging and billing trails; the captured agent demonstrates how an exposed inference endpoint can become a pivot point for wider exploitation.
• Procurement leaders and platform owners: The instruction layers show operators will attempt to disguise model identity and normalize access to secrets; scrutiny of service configurations and controls around API keys and environment variables is essential.
• End users and administrators: The captured tool's emphasis on quiet cryptocurrency mining and reinfection highlights that compromise may show up first as unexpected resource usage or unexplained charges for inference and compute.

Symantec's capture provides an unusually complete view into a modular, autonomous attack tool built around a reasoning model and a toolkit of exploit modules. The researchers found no proof it had been unleashed at scale, but the design — 74 offensive modules, identity-deception layers, and a "Skynet mode" authorized for 100,000 unattended steps — makes clear a simple fact: operators have moved from jailbreaks that trick a single chatbot to tools that hunt for and attempt to commandeer other models and hosts. The discovery leaves defenders with specific signals to monitor and a question that Symantec's evidence does not yet answer: who, if anyone, will test the kit in the wild?

Original story